CVE-2018-7797

A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert 1.3 (formerly Power Manager), EcoStruxure Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxure Power Monitoring Expert (PME) v9.0, EcoStruxure Energy Expert v2.0, and EcoStruxure Power SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module which could cause a phishing attack when redirected to a malicious site.

• CWE-601

• http://www.securityfocus.com/bid/106277Third Party Advisory, VDB Entry
• https://www.schneider-electric.com/en/download/document/SEVD-2018-347-01/Vendor Advisory
• http://www.securityfocus.com/bid/106277Third Party Advisory, VDB Entry
• https://www.schneider-electric.com/en/download/document/SEVD-2018-347-01/Vendor Advisory

Published

Dec 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7791A Permissions, Privileges, and Access Control vulnerability …9.8
• CVE-2018-7792A Permissions, Privileges, and Access Control vulnerability …7.5
• CVE-2018-7793A Credential Management vulnerability exists in FoxView HMI …
• CVE-2018-7794A CWE-754: Improper Check for Unusual or Exceptional Conditi…7.5
• CVE-2018-7795A Cross Protocol Injection vulnerability exists in Schneider…5.4
• CVE-2018-7796A Buffer Error vulnerability exists in PowerSuite 2, all rel…
• CVE-2018-7798A Insufficient Verification of Data Authenticity (CWE-345) v…8.2
• CVE-2018-7799A DLL hijacking vulnerability exists in Schneider Electric S…
• CVE-2018-7800A Hard-coded Credentials vulnerability exists in EVLink Park…
• CVE-2018-7801A Code Injection vulnerability exists in EVLink Parking, v3.…8.8
• CVE-2018-7802A SQL Injection vulnerability exists in EVLink Parking, v3.2…
• CVE-2018-7803A CWE-754 Improper Check for Unusual or Exceptional Conditio…